Getting Data In
Highlighted

Create user and grant him search privilege on a specific index with cURL

Explorer

Hi guys,

I'm trying to create a user and only grant him search privileges on a specific index using cURL. So far I used these two commands:
Index creation:

curl -k -u admin:password https://SplunkIP:8089/servicesNS/admin/search/data/indexes -d name=mytest

And I found this command example for the user creation:

curl -k -u admin:password https://SplunkIP:8089/services/authentication/users -d name=User1 -d password=changeme -d roles=role

So as far, as I understood, I can directly affect an existing role while creating the User1 account, but I would like to create a specific role which allows him to only read and search from the mytest index.

I found a "createrole" parameter for the last cURL, but it's not clear from the documentation.

So is it possible to create / specify the role while creating a new user? Or is there any other cURL command which can create a role?

Thank you very much !

0 Karma
Highlighted

Re: Create user and grant him search privilege on a specific index with cURL

SplunkTrust
SplunkTrust

You can create a role for the user but not sure if you can customize the role that way. Better option is to create the role separately (before creating user) with all the customization (index access) and then assign that role to the user while creating (or update if already created). See this link for roles creation curl using Splunk REST API

http://docs.splunk.com/Documentation/Splunk/6.2.6/RESTREF/RESTaccessExamples#authorization.2Froles_P...

0 Karma
Highlighted

Re: Create user and grant him search privilege on a specific index with cURL

Create a role
And Attach your filter to that role...

Check.. [role_<< roleName >>] --> srchFilter in https://docs.splunk.com/Documentation/Splunk/latest/Admin/authorizeconf

or
Give your filter in the field Restrict search terms in UI while creating role

And Assign that role to your User

0 Karma